logstash formatter and some fix